fix: pretty-print IRIS alert_note as indented JSON with nulls stripped

Replace plain-text sectioned format with json.dumps(indent=2) so the
Alert Note field in IRIS renders as readable indented JSON. Null values
are recursively removed to keep the output clean. IOC verdict fields
(vt_stats, abuseipdb_score/reports, reason) are flattened into the
verdicts array for easy scanning.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

soc-integrator/app/services/mvp_service.py

@@ -656,71 +656,41 @@ class MvpService:
         severity_str = (event.get("severity") or "medium").lower()
         severity_id = _IRIS_SEVERITY_ID.get(severity_str, 3)
 
-        note_lines: list[str] = []
-
-        # Asset
-        asset = event.get("asset") or {}
-        if any(asset.get(k) for k in ("hostname", "user", "agent_id")):
-            note_lines.append("## Asset")
-            if asset.get("hostname"):
-                note_lines.append(f"  Hostname : {asset['hostname']}")
-            if asset.get("user"):
-                note_lines.append(f"  User     : {asset['user']}")
-            if asset.get("agent_id"):
-                note_lines.append(f"  Agent ID : {asset['agent_id']}")
-
-        # Network
-        network = event.get("network") or {}
-        net_fields = {k: network.get(k) for k in ("src_ip", "dst_ip", "dst_port", "dst_host", "proto") if network.get(k)}
-        if net_fields:
-            note_lines.append("\n## Network")
-            for k, v in net_fields.items():
-                note_lines.append(f"  {k:<12}: {v}")
-
-        # IOC verdicts
+        def _strip_nulls(obj: Any) -> Any:
+            """Recursively remove None values to keep the JSON compact."""
+            if isinstance(obj, dict):
+                return {k: _strip_nulls(v) for k, v in obj.items() if v is not None}
+            if isinstance(obj, list):
+                return [_strip_nulls(i) for i in obj]
+            return obj
+
         raw = event.get("raw") or {}
-        verdicts: list[dict[str, Any]] = raw.get("verdicts") or []
-        if verdicts:
-            note_lines.append("\n## IOC Verdicts")
+        note_data: dict[str, Any] = {
+            "asset": event.get("asset") or {},
+            "network": event.get("network") or {},
+            "tags": event.get("tags") or [],
+        }
+        if raw.get("verdicts"):
             ioc_payload = raw.get("payload") or {}
-            if ioc_payload.get("ioc_value"):
-                note_lines.append(f"  IOC      : {ioc_payload.get('ioc_type','?')} / {ioc_payload['ioc_value']}")
-            for v in verdicts:
-                provider = v.get("provider", "?")
-                matched = v.get("matched", False)
-                conf = v.get("confidence", 0.0)
-                sev = v.get("severity", "?")
-                result = v.get("result") or {}
-                note_lines.append(f"\n  [{provider.upper()}]")
-                note_lines.append(f"    Matched    : {'YES' if matched else 'no'}")
-                note_lines.append(f"    Confidence : {conf:.0%}")
-                note_lines.append(f"    Severity   : {sev}")
-                # Provider-specific detail
-                providers_detail = (result.get("providers") or {})
-                vt = providers_detail.get("virustotal", {})
-                if vt.get("stats"):
-                    s = vt["stats"]
-                    note_lines.append(
-                        f"    VT Stats   : malicious={s.get('malicious',0)} "
-                        f"suspicious={s.get('suspicious',0)} "
-                        f"harmless={s.get('harmless',0)} "
-                        f"undetected={s.get('undetected',0)}"
-                    )
-                ab = providers_detail.get("abuseipdb", {})
-                if ab:
-                    note_lines.append(
-                        f"    AbuseIPDB  : score={ab.get('score',0)} "
-                        f"reports={ab.get('totalReports',0)}"
-                    )
-                if result.get("reason"):
-                    note_lines.append(f"    Reason     : {result['reason']}")
-
-        # Tags
-        tags = event.get("tags") or []
-        if tags:
-            note_lines.append(f"\n## Tags\n  {', '.join(str(t) for t in tags)}")
-
-        alert_note = "\n".join(note_lines).strip()
+            note_data["ioc"] = {
+                "type": ioc_payload.get("ioc_type"),
+                "value": ioc_payload.get("ioc_value"),
+                "verdicts": [
+                    {
+                        "provider": v.get("provider"),
+                        "matched": v.get("matched"),
+                        "confidence": round(float(v.get("confidence") or 0), 4),
+                        "severity": v.get("severity"),
+                        "reason": (v.get("result") or {}).get("reason"),
+                        "vt_stats": ((v.get("result") or {}).get("providers") or {}).get("virustotal", {}).get("stats"),
+                        "abuseipdb_score": ((v.get("result") or {}).get("providers") or {}).get("abuseipdb", {}).get("score"),
+                        "abuseipdb_reports": ((v.get("result") or {}).get("providers") or {}).get("abuseipdb", {}).get("totalReports"),
+                    }
+                    for v in raw["verdicts"]
+                ],
+            }
+
+        alert_note = json.dumps(_strip_nulls(note_data), indent=2, ensure_ascii=False)
 
         payload: dict[str, Any] = {
             "alert_title": event.get("title") or f"Wazuh alert {event_id}",